#####################################
# Plugins Settings
#####################################
# Enable the plugin framework
PLUGINS_ENABLED=true
# Enable auto-completion for plugins CLI
PLUGINS_CLI_COMPLETION=false
# Set markup mode for plugins CLI
# Valid options:
# rich: use rich markup
# markdown: allow markdown in help strings
# disabled: disable markup
# If unset (commented out), uses "rich" if rich is detected, otherwise disables it.
PLUGINS_CLI_MARKUP_MODE=rich
# Configuration path for plugin loader
PLUGINS_CONFIG=./resources/plugins/config.yaml
# Transport type - 'http', 'stdio', 'grpc', or 'unix'
# - http: MCP over HTTP (default, works with any client)
# - stdio: MCP over stdio (for subprocess-based plugins)
# - grpc: gRPC transport (high-performance, requires grpc extras)
# - unix: Unix socket transport (high-performance local IPC, requires grpc extras)
PLUGINS_TRANSPORT=http
# Server address (default: 0.0.0.0) - HTTP mode only
# PLUGINS_SERVER_HOST=0.0.0.0
# Server port (default: 8000) - HTTP mode only
# PLUGINS_SERVER_PORT=8000
# Enable SSL/TLS (true/false) - HTTP mode only
# PLUGINS_SERVER_SSL_ENABLED=false
# Path to server private key - HTTP mode only
# PLUGINS_SERVER_SSL_KEYFILE=
# Path to server certificate - HTTP mode only
# PLUGINS_SERVER_SSL_CERTFILE=
# Path to CA bundle for client verification - HTTP mode only
# PLUGINS_SERVER_SSL_CA_CERTS=
# Client cert requirement (0=NONE, 1=OPTIONAL, 2=REQUIRED) - HTTP mode only
# PLUGINS_SERVER_SSL_CERT_REQS=
#####################################
# MCP External Plugin Server - mTLS Configuration
#####################################
# Enable SSL/TLS for external plugin MCP server
# Options: true, false (default)
# When true: Enables HTTPS and optionally mTLS for the plugin MCP server
MCP_SSL_ENABLED=false
# SSL/TLS Certificate Files
# Path to server private key (required when MCP_SSL_ENABLED=true)
# Generate with: openssl genrsa -out certs/mcp/server.key 2048
# MCP_SSL_KEYFILE=certs/mcp/server.key
# Path to server certificate (required when MCP_SSL_ENABLED=true)
# Generate with: openssl req -new -x509 -key certs/mcp/server.key -out certs/mcp/server.crt -days 365
# MCP_SSL_CERTFILE=certs/mcp/server.crt
# Optional password for encrypted private key
# MCP_SSL_KEYFILE_PASSWORD=
# mTLS (Mutual TLS) Configuration
# Client certificate verification mode:
# 0 (CERT_NONE): No client certificate required - standard TLS (default)
# 1 (CERT_OPTIONAL): Client certificate optional - validate if provided
# 2 (CERT_REQUIRED): Client certificate required - full mTLS
# Default: 0 (standard TLS without client verification)
MCP_SSL_CERT_REQS=0
# CA certificate bundle for verifying client certificates
# Required when MCP_SSL_CERT_REQS=1 or MCP_SSL_CERT_REQS=2
# Can be a single CA file or a bundle containing multiple CAs
# MCP_SSL_CA_CERTS=certs/mcp/ca.crt
#####################################
# gRPC Plugin Server Configuration
# (only used when PLUGINS_TRANSPORT=grpc)
#####################################
# gRPC server host (default: 0.0.0.0)
# PLUGINS_GRPC_SERVER_HOST=0.0.0.0
# gRPC server port (default: 50051)
# PLUGINS_GRPC_SERVER_PORT=50051
# gRPC Unix domain socket path (alternative to host:port)
# When set, host/port are ignored. Provides highest local performance.
# TLS is not supported with Unix domain sockets.
# PLUGINS_GRPC_SERVER_UDS=/var/run/grpc-plugin.sock
# gRPC TLS/mTLS Configuration (not supported when using UDS)
# Enable TLS (required to enable TLS)
# PLUGINS_GRPC_SERVER_SSL_ENABLED=true
# Path to server certificate (required when SSL_ENABLED=true)
# PLUGINS_GRPC_SERVER_SSL_CERTFILE=certs/grpc/server.pem
# Path to server private key (required when SSL_ENABLED=true)
# PLUGINS_GRPC_SERVER_SSL_KEYFILE=certs/grpc/server-key.pem
# Path to CA bundle for client certificate verification (enables mTLS)
# PLUGINS_GRPC_SERVER_SSL_CA_CERTS=certs/grpc/ca.pem
# Client certificate requirement mode:
# none: No client certificate required (TLS only)
# optional: Client certificate validated if provided
# require: Client certificate required (full mTLS)
# Default: require (when CA bundle is provided)
# PLUGINS_GRPC_SERVER_SSL_CLIENT_AUTH=require
#####################################
# Unix Socket Plugin Server Configuration
# (only used when PLUGINS_TRANSPORT=unix)
#####################################
# Path to Unix domain socket file
# UNIX_SOCKET_PATH=/tmp/mcpgateway-plugins.sock
